It is often difficult to know how much scrutiny should be applied to network traffic/activity associated with a particular device, item, or network element. In particular, it may be difficult to determine when the associated traffic should be blocked for protective purposes. In conventional communication networks, monitoring and/or examination of traffic may be done relatively crudely, e.g., in an all or nothing fashion, may be done manually, which may be costly, and/or may be done automatically in a pre-determined fashion, which may result in too many false positives (i.e., blocking traffic that need not be blocked) and/or false negatives (i.e., allowing traffic that should be blocked and/or blocking the wrong traffic). Accordingly, there remains room for improvement in traffic monitoring, examination, and/or blocking systems and methods.